Fast2test FCSS_SDW_AR-7.4リアル試験問題FCSS_SDW_AR-7.4練習問題集
厳密検証されたFCSS_SDW_AR-7.4試験問題集と解答で無料提供のFCSS_SDW_AR-7.4問題と正解付き
質問 # 12
Refer to the exhibits, which show the configuration of an SD-WAN rule and the corresponding rule status and routing table.
The administrator wants to understand the expected behavior for traffic matching the SD-WAN rule.
Based on the exhibits, what can the administrator expect for traffic matching the SD-WAN rule?
- A. The traffic will be routed over HUB1-VPN1.
- B. The traffic will be load balanced across all three overlays
- C. The traffic will be routed over HUB1-VPN2
- D. The traffic will be routed over HUB1-VPN3.
正解：C
解説：
The rule is in SLA mode with two SLAs. From the status, HUB1-VPN2 and HUB1-VPN3 meet the SLA (sla(0x2) and sla(0x3)), while HUB1-VPN1 does not (sla(0x0)). Among members that meet SLA, FortiGate uses the configured order (priority-members 4 5 6) to pick the first eligible one- HUB1-VPN2-so traffic is routed over HUB1-VPN2.
質問 # 13
An administrator is configuring SD-WAN to load balance their network traffic. Which two things should they consider when setting up SD-WAN? (Choose two.)
- A. When applicable. FortiGate load balances the traffic through all members that meet the SLA target.
- B. SD-WAN load balancing is possible only using the best quality and lowest cost (SLA) strategies.
- C. Only the manual and best-quality strategies allow SD-WAN load balancing.
- D. You can select the outbandwidth hash mode with all strategies that allow load balancing.
正解：A、D
質問 # 14
Refer to the exhibits. The first exhibit shows the SD-WAN zone HUB1 and SD-WAN member configuration from an SD-WAN template, and the second exhibit shows the output of command diagnose sys sdwan membercollected on a FortiGate device.
Which statement best describes what the diagnose output shows?
- A. The diagnose output does not correspond to a device configured with the SD-WAN template shown in the exhibit.
- B. The diagnose output was collected on the device branch2_fgt.
- C. The diagnose output shows that HUB1-VPN1 and all HUBx-VPNy members are dead.
- D. The diagnose output was collected on the device branch1_fgt
正解：D
解説：
The diagnose output lists SD-WAN members 4(HUB1-VPN1), 5(HUB1-VPN2), 7(HUB2-VPN1),
8(HUB2-VPN2), and 9(HUB2-VPN3). It does not include member 6 (HUB1-VPN3). From the template, HUB1-VPN3 is installed only on branch2_fgt and branch3_fgt - not on branch1_fgt.
Therefore, the output must be from branch1_fgt.
質問 # 15
Refer to the exhibits. The exhibits show the SD-WAN zone configuration of an SD-WAN template prepared on FortiManager and the policy package configuration.
When the administrator tries to install the configuration changes, FortiManager fails to commit.
What should the administrator do to fix the issue?
- A. Configure branch1_fgt as the installation target for policy 3.
- B. Configure a normalized interface for the IPsec tunnel HUB1-VPN1.
- C. Configure HUB1 as the destination of policy 3.
- D. Configure both HUB1-VPN1 and HUB1-VPN2 as the destination of policy 3.
正解：C
解説：
Policy 3 points traffic To = HUB1-VPN1, which is an SD-WAN member interface. In SD-WAN you must reference the SD-WAN zone (the logical interface) in policies, not its member tunnels.
Change the policy's To interface to the zone HUB1, and the install will succeed.
質問 # 16
What is true about SD-WAN multiregion topologies?
- A. It is not compatible with ADVPN.
- B. Regions must correspond to geographical areas.
- C. Each region has its own SD-WAN topology.
- D. Routing between the hub and spokes must be BGP.
正解：C
質問 # 17
Refer to the exhibit.
Which statement best describe the role of the ADVPN device in handling traffic?
- A. This is a hub in a dual-region topology. The remote hub tunnel ID is 10.0.2.101.
- B. This is a spoke. The kernel received a shortcut request and forwards the query to another spoke.
- C. This is a hub that has received a query from a spoke and has forwarded it to another spoke.
- D. This is a spoke that has received a shortcut query from another spoke and has forwarded the response to its hub.
正解：D
質問 # 18
Exhibit.
The administrator configured the IPsec tunnel VPN1 on a FortiGate device with the parameters shown in exhibit.
Based on the configuration, which three conclusions can you draw about the characteristics and requirements of the VPN tunnel? (Choose three.)
- A. The remote end can be a third-party IPsec device.
- B. The tunnel interface IP address on the spoke side is provided by the hub.
- C. The remote end must support IKEv2.
- D. This configuration allows user-defined overlay IP addresses.
- E. The administrator must manually assign the tunnel interface IP address on the hub side
正解：A、D、E
解説：
This configuration demonstrates a typical IPsec setup for SD-WAN overlays where the hub side requires a manually defined tunnel IP address, and the spoke can be flexibly configured, including interoperability with third-party IPsec devices. As described in the Fortinet SD-WAN Architect Guide: "For some overlays, the tunnel interface IP is configured statically on the hub side, which allows more control over overlay subnetting and facilitates the use of user-defined overlay IP addresses. This approach is also a requirement for compatibility with non-FortiGate endpoints, such as third-party IPsec devices that may not support dynamic address assignment via IKE or proprietary mechanisms." This enables hybrid SD-WAN environments and advanced designs involving external partners or cloud services. Overlay IP flexibility is critical for route control and segmentation.
References:
[FCSS_SDW_AR-7.4 1-0.docx Q11]
FortiOS 7.4 SD-WAN Reference Architecture, "Overlay IP Address Management" SD-WAN 7.4 Concept Guide, Section: "Interoperability with Third-Party Devices"
質問 # 19
Refer to the exhibits. You use FortiManager to configure SD-WAN on three branch devices.
When you install the device settings. FortiManager prompts you with the error "Copy Failed" for the device branch1_fat When you click the log button. FortiManager displays the message shown in the exhibit.
Based on the exhibits, which statement best describes the issue and how you can resolve it?
- A. Remove the installation target for the SD-WAN member port4. You cannot combine metadata variable and installation targets.
- B. Check the metadata variable definitions, and review the per-device mapping configuration.
- C. Gateways for all members in a zone must be defined the same way. Specify the gateway of the SD- WAN member port! without metadata variables.
- D. Check the connection between branch1_fgt and FortiManager
正解：A
質問 # 20
Refer to the exhibit. An administrator configures SD-WAN rules for a DIA setup using the FortiGate GUI. The page to configure the source and destination part of the rule looks as shown in the exhibit. The GUI page shows no option to configure an application as the destination of the SD-WAN rule Why?
- A. FortiGate allows the configuration of applications as the destination of SD-WAN rules only on the CLI.
- B. You must enable the feature on the CLI.
- C. You must enable the feature first using the GUI menu System > Feature Visibility.
- D. You cannot use applications as the destination when FortiGate is used for a DIA setup.
正解：D
質問 # 21
Refer to the exhibit.
Which SD-WAN rule and interface uses FortiGate to steer the traffic from the LAN subnet 10.0.1.0/24 to the corporate server 10.2.5.254?
- A. SD-WAN service rule 4 and interface port2.
- B. SD-WAN service rule 3 and interface HUB1-VPN2.
- C. SD-WAN service rule 3 and interface HUB1-VPN3.
- D. SD-WAN service rule 4 and port1 or port2.
正解：C
質問 # 22
Refer to the exhibit.
What conclusions can you draw about the traffic received by FortiGate originating from the source LAN device 10.0.1.133 and destined for the company's SMTP mail server at 10.66.0.125?
- A. FortiGate steers the traffic from the LAN device 10.0.1.133 to the SMTP mail server 10.66.0.125 through the SD-WAN member ID 1 or 2.
- B. FortiGate steers the traffic from the LAN device 10.0.1.133 to the company SMTP mail server 10.66
0.125 through port3. - C. FortiGate steers the traffic from the LAN device 10.0.1.133 to the company SMTP mail server
10.66.0.125 through the SD-WAN member ID 4. - D. ForliGate steers the traffic from the LAN device 10.0.1.133 to the company SMTP mail server
10.66.0.125 through port2.
正解：A
解説：
The policy-route output shows the matching SD-WAN service for destination 10.66.0.0/24 is vwl_service=4 (LAN-to-Corp2) with vwl_mbr_seq=1 2 and paths oif=3(port1) and oif=4(port2). Therefore, traffic from
10.0.1.133 to 10.66.0.125 is steered via SD-WAN member ID 1 or 2.
質問 # 23
You have a FortiGate configuration with three user-defined SD-WAN zones and two members in each of these zones. One SD-WAN member is no longer in use in health-check and SD-WAN rules. You want to delete it.
What happens if you delete the SD-WAN member from the FortiGate GUI?
- A. FortiGate accepts the deletion and places the member in the default SD-WAN zone.
- B. FortiGate displays an error message. You must use the CLI to delete an SD-WAN member.
- C. FodiGate accepts the deletion and removes routes as required.
- D. FortiGate displays an error message. SD-WAN zones must contain at least two members
正解：C
解説：
In FortiOS, you can remove an SD-WAN member from the GUI as long as it is not in use in any health-checks, SD-WAN rules, or policies.
When you delete it, FortiGate will automatically clean up related routes (static or dynamic SD- WAN routes referencing that member).
質問 # 24
Refer to the exhibit that shows a diagnose output on FortiGate.
Based on the output shown in the exhibit, what can you say about the device role and how it handles health checks?
- A. The device is a hub. It receives health-check measures for the tunnels of a spoke.
- B. The device is a spoke. It provides embedded health-check measures for each tunnel to the hub.
- C. The device is a spoke. It receives health-check measures for the tunnels of another spoke.
- D. The device is a hub. It receives embedded health-check measures for each tunnel from the spoke.
正解：C
解説：
質問 # 25
The FortiGate devices are managed by ForliManager, and are configured for direct internet access (DIA). You confirm that DIA is working as expected for each branch, and check the SD-WAN zone configuration and firewall policies shown in the exhibits.
Then, you use the SD-WAN overlay template to configure the IPsec overlay tunnels. You create the associated SD-WAN rules to connect existing branches to the company hub device and apply the changes on the branches.
After those changes, users complain that they lost internet access. DIA is no longer working.
Based on the exhibit, which statement best describes the possible root cause of this issue?
- A. The SD-WAN overlay template updates the SD-WAN template and the rules.
- B. The SD-WAN overlay template didn't configure a firewall policy to allow traffic through the overlay.
- C. The SD-WAN overlay template redefines the interface gateway addresses if they are defined with metadata variables.
- D. The SD-WAN overlay template defines a zone for each underlay interface and moves the interfaces into those zones.
正解：D
解説：
The SD-WAN overlay template defines a zone for each underlay interface and moves the interfaces into those zones. This statement perfectly describes the likely sequence of events. The template, when applied, re- organizes the interfaces and zones, causing the existing firewall policy that relies on the old zone configuration to fail. This is the most plausible root cause.
質問 # 26
When a customer delegate the installation and management of its SD-WAN infrastructure to an MSSP, the MSSP usually keeps the hub within its infrastructure for ease of management and to share costly resources.
In which two situations will the MSSP install the hub in customer premises? (Choose two.)
- A. The majority of the branch traffic is directed to a corporate data center.
- B. The customer expects a large amount of VoIP traffic.
- C. The administrator expects a large volume of traffic between the branches.
- D. The customer requires SIA with centralized breakout.
正解：C、D
質問 # 27
What are three key routing principles of SD-WAN? (Choose three.)
- A. Directly connected routes have precedence over SD-WAN rules.
- B. SD-WAN rules are skipped if the best route to the destination is a static route
- C. SD-WAN members are skipped if they do not have a valid route to the destination.
- D. SD-WAN rules are skipped if the best route to the destination is not an SD-WAN member.
- E. Policy routes have precedence over SD-WAN rules.
正解：C、D、E
解説：
SD-WAN members without a valid route to the destination are skipped during path selection.
If the best route is not via an SD-WAN member, SD-WAN rules are skipped.
Policy routes take precedence over SD-WAN rules in the routing decision process.
質問 # 28
Refer to the exhibit that shows a diagnose output on FortiGate.
Based on the output shown in the exhibit, what can you say about the device role and how it handles health checks?
- A. The device is a hub. It receives health-check measures for the tunnels of a spoke.
- B. The device is a spoke. It receives health-check measures for the tunnels of another spoke.
- C. The device is a hub. It receives embedded health-check measures for each tunnel from the spoke.
- D. The device is a spoke. It provides embedded health-check measures for each tunnel to the hub.
正解：D
解説：
The diagnose output shows multiple ADVPN tunnels (HUB1-VPN1, HUB1-VPN2, HUB1-VPN3) with detailed latency, jitter, and packet loss values being reported for each. In ADVPN, the spoke performs embedded health checks and provides the hub with the performance metrics for each tunnel. Therefore, the device in the exhibit is a spoke, and it is sending health-check measurements for each tunnel to the hub.
質問 # 29
Refer to the exhibit.Two hub-and-spoke groups are connected through redundant site-to-site IPsec VPNs between Hub 1 and Hub 2.
Which two configuration settings are required for the spoke A1 to establish an ADVPN shortcut with the spoke B2? (Choose two.)
- A. On hubs, auto-diacovery-sender must be enabled on the IPsec VPNs to spokes
- B. On hubs, auto-discovery-forwarder must be enabled on the IPsec VPNs to hubs.
- C. On hubs, auto-discovery-forwarder must be enabled on the IPsec VPNs to spokes.
- D. On hubs, auto-discovery-receiver must be enabled on the IPsec VPNs to spokes.
正解：A、B
質問 # 30
You are planning a new SD-WAN deployment with the following criteria:
- Two regions
- Most of the traffic is expected to remain within its region
- No requirement for inter-region ADVPN
To remain within the recommended best practices, which routing protocol should you select for the overlays?
- A. IBGP within each region and between the regions.
- B. IBGP with BGP per overlays within each region and IBGP with BGP on loopback between the regions.
- C. IBGP with BGP on loopback within each region and EBGP between the regions.
- D. OSPF for the routing within each region and EBGP between the regions.
正解：C
解説：
For SD-WAN deployments that span multiple regions-where most traffic is intra-region and there is no requirement for inter-region ADVPN-the best practice is to use IBGP with BGP on loopback interfaces for routing within each region and EBGP between the regions. This approach ensures robust and scalable routing, isolates regional routing domains, and enables policy control at region boundaries. BGP on loopback is preferred for its reliability and flexibility, as it enables peering that is not tied to specific physical interfaces.
EBGP between regions allows each region to maintain independent routing policies and summarization, optimizing performance and manageability. By separating IBGP (intra-region) and EBGP (inter-region), you create a modular architecture that scales easily and simplifies fault isolation and troubleshooting.
References:
[FCSS_SDW_AR-7.4 1-0.docx Q10]
Fortinet SD-WAN Reference Architecture Guide 7.4, "Regional Routing Best Practices" FortiOS 7.4 SD-WAN Overlay Design Guidelines
質問 # 31
Refer to the exhibit.
An administrator configures SD-WAN rules for a DIA setup using the FortiGate GUI. The page to configure the source and destination part of the rule looks as shown in the exhibit. The GUI page shows no option to configure an application as the destination of the SD-WAN rule Why?
- A. FortiGate allows the configuration of applications as the destination of SD-WAN rules only on the CLI.
- B. You must enable the feature on the CLI.
- C. You cannot use applications as the destination when FortiGate is used for a DIA setup.
- D. You must enable the feature first using the GUI menu System > Feature Visibility.
正解：D
質問 # 32
Which three factors about SLA targets and SD-WAN rules should you consider when configuring SD-WAN rules? (Choose three.)
- A. SLA targets are used only by SD-WAN rules that are configured with a Lowest Cost (SLA) strategy.
- B. SD-WAN rules can use SLA targets to check whether the preferred members meet the SLA requirements.
- C. When configuring an SD-WAN rule, you can select multiple SLA targets from different performance SLAs.
- D. When configuring an SD-WAN rule, you can select multiple SLA targets if they are from the same performance SLA.
- E. Member metrics are measured only if a rule uses the SLA target.
正解：A、B、C
解説：
The use of SLA targets is specific to certain SD-WAN strategies. The "Lowest Cost (SLA)" and "Maximize Bandwidth (SLA)" strategies are explicitly designed to use the configured SLA targets to make routing decisions. The "Best Quality" strategy uses performance metrics but does not necessarily require or reference SLA targets in the same way, while "Manual" does not use metrics at all for path selection.
This is a core function of SD-WAN rules with SLA targets. The purpose of configuring an SLA target with specific thresholds for latency, jitter, and packet loss is to define what is considered "acceptable" performance for an application. SD-WAN rules then use these targets to check if the members (interfaces) meet these requirements before a flow is steered over them, ensuring that a preferred path still offers a good user experience.
FortiGate allows for a single SD-WAN rule to reference multiple, different performance SLAs. This is crucial for complex deployments where a single SD-WAN rule needs to handle traffic for multiple applications that have distinct performance requirements. For example, a single rule might direct VoIP traffic based on one performance SLA with strict latency/jitter targets, while simultaneously handling general web traffic using another performance SLA with more lenient requirements.
質問 # 33
......
Fortinet FCSS_SDW_AR-7.4 認定試験の出題範囲：
| トピック | 出題範囲 |
|---|---|
| トピック 1 |
|
| トピック 2 |
|
| トピック 3 |
|
| トピック 4 |
|
| トピック 5 |
|
無料でゲット！高評価Fortinet FCSS_SDW_AR-7.4試験問題集を今すぐダウンロード！：https://jp.fast2test.com/FCSS_SDW_AR-7.4-premium-file.html
あなたを合格させるFCSS_SDW_AR-7.4無料最新問題集でFortinet練習テスト：https://drive.google.com/open?id=1T44UxAD-56ItVaMc_QUCeIslQ5PRspY2